CVE-2025-59230: high-severity vulnerability in Microsoft Windows 10 Version 1507
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
The Windows Remote Access Connection Manager doesn't properly check who should have access to certain features, letting someone with basic user rights gain higher-level control on their own computer.
CWE-284 (Improper Access Control) in Windows Remote Access Connection Manager allows a local authenticated user to escalate privileges through inadequate access control mechanisms. The vulnerability requires local access and valid credentials, but enables privilege elevation to higher system levels with a CVSS score of 7.8.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.